New Asprotect?

i managed to make a working dump and found OEP for whereisit? 3.60 ... but can't fix IAT ..has anyone been able to find a solution for this?

@Crk: britedream just posted that he unpacked latest whereisit. I'm sure he'll tell you how.

Hmm, is the OEP at 006FB5EC ?

since i couldn't fix IAT i deleted all files... i forgot which one is but manually you will be able to find it ... look with W32Dasm for the string : WHEREISIT.CHM

a little up is OEP where that piece of code start (558BEC......)

there are not stolen bytes!

i'm waiting for britedream tut about fixing IAT
it looks new asprotect and armadillo are using almost same technique to protect IAT this time .. for how long?

Regards.

@Crk: Ok, then at least I had found the OEP and dumped the exe.

[britedream]

in the new asprotect just use peid oep finder when checking the protection, it will give you the correct oep if not protected , in the two I checked it gave the correct oep.

Since no one has posted a solution for fixing IAT of new asprotect, i post here a simple solution. I do not know it works in any situation since i did not try it on commercial software but u can check it out. I think that my solution is just an application of different suggestions i find in this forum.

I took the Unpackmenow as an example.

Regards
deviljin